How to work around with Safari login required problem?

Thanks for sharing your set up and results @pedro3 !

The refresh token rotation grant operates mainly on a window session storage object to store the rotating refresh token, not a session cookie. This makes me wonder if your current setup works with this grant or still with a default one coming with some SDKs - cookies-based silent authentication :thinking:

But I can’t also rule out that some component within the SDK still uses cookies. (I came upon this doc mentioning the legacySameSiteCookie option being enabled by default.)

My suggestion: following the doc, can you please add the option
legacySameSiteCookie={false} to your SDK configuration?

You can also share with me the specific Auth0’s doc (quick starts) and SDKs you have used to set your app with Auth0 so I would try to set a sample app locally running the refresh token rotation grant in Safari.

For the Silent Authentication to work with browsers that prohibit 3party cookies, the workaround is also to set Auth0 to use custom domain (a paid feature), so that your app domain and the Auth0 domain are the same → then Auth0 cookies wan’t be considered 3d party.